Encrypted traffic attack behavior training and identification method

Abstract

The invention discloses an encrypted traffic attack behavior training and identification method. The method comprises the following steps: acquiring traffic data; respectively inputting the flow data into a recognition model to obtain a first feature map and a second feature map; inputting the first feature map and the second feature map into a classifier of the recognition model to obtain an attack type of the traffic data; wherein the recognition model is a deep learning model obtained based on sample training; the identification model is formed by a double-layer high-order convergence LM-Trans model, and the double-layer high-order convergence LM-Trans model comprises two parallel LM-Trans models based on high-order convergence; the recognition model is trained through a high-order convergence LM algorithm to obtain a fast convergence recognition model. According to the invention, the integrity of the encrypted traffic information can be ensured, the defect of the current encrypted traffic identification model in the aspect of convergence speed can be made up, and the malicious encrypted traffic attack behavior identification hit rate can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and particularly relates to a method for training and identifying encrypted traffic attack behaviors. Background Art

[0002] With the rapid development of network communication technology, network security threats have been increasing year by year. More and more network communications adopt encryption technology during transmission to protect data security and privacy. Encrypted communication is widely used in fields such as websites, applications, emails, instant messaging, and VOIP. However, while encrypted traffic prevents network security problems such as data theft, it has also become a common attack method used by hackers. Malicious traffic uses encryption technology to hide malicious attack behaviors, making traditional detection methods such as deep packet inspection and port-based traffic classification no longer reliable.

[0003] With the development of artificial intelligence technology, machine learning algorithms such as random forest and SVM can distinguish malicious encrypted traffic from normal encrypted traffic by feature extraction. However, most of these methods are based on manually designed flow features, losing a large amount of packet details, making fine-grained operations impossible, thus affecting the recognition accuracy. To solve the feature engineering problem, the end-to-end deep learning encrypted traffic detection method has become a research hotspot, but at the same time, it has also posed a new test to the robustness of the encrypted traffic defense model.

[0004] Although existing deep learning methods can learn network traffic features and achieve malicious encrypted traffic detection, they themselves have problems such as being sensitive to initial parameters, slow algorithm convergence speed, numerous preset parameters and lack of effective selection methods, and being prone to falling into local minima, resulting in problems such as slow training speed, low recognition accuracy, and poor generalization ability when the model faces large-scale and feature-complex highly concealed abnormal traffic data.

[0005] Technical Term: Pcap: The full English name is packet capture, and the full Chinese name is "packet capture". It is an application programming interface for capturing network traffic, and the captured packet file format is the Pcap format; Swin Transformer: This model is an improved version of Transformer. Its full English name is Hierarchical Vision Transformer using Shifted Windows, and the full Chinese name is "Hierarchical Vision Transformer Based on Shifted Windows". It is a general vision task model that can solve general image processing problems such as image feature extraction, image recognition, and image segmentation.

[0006] LM: The full name in English is Levenberg-Marquardt, and the full name in Chinese is Levenberg-Marquardt method, which is an estimation method for least squares estimation of regression parameters in nonlinear regression. Summary of the invention

[0007] In view of the shortcomings of the prior art, the purpose of the present invention is to provide an encrypted traffic attack behavior training and identification method, which can ensure the integrity of encrypted traffic information while making up for the shortcomings of the current encrypted traffic identification model in terms of convergence speed and improve the hit rate of malicious encrypted traffic attack behavior identification. In order to achieve the above-mentioned purpose and other advantages according to the present invention, an encrypted traffic attack behavior training and identification method is provided, comprising the following steps: Get traffic data; Inputting the flow data into the recognition model respectively to obtain a first feature map and a second feature map, and fusing the first feature map and the second feature map; Inputting the first characteristic graph and the second characteristic graph into a recognition model to obtain an attack type of the traffic data; Wherein, the recognition model is a deep learning model obtained based on sample training; The recognition model is composed of a double-layer high-order convergence LM-Trans model, which includes two parallel high-order convergence-based LM-Trans models; the recognition model is trained by a high-order convergence LM algorithm to obtain a fast-converging recognition model.

[0008] Preferably, the high-order convergent LM algorithm refers to an algorithm that calculates a step size based on the LM algorithm and performs training according to the step size.

[0009] Preferably, the model based on the Swin Transformer architecture includes: two consecutive LM-Trans Blocks and Patch merging based on the window attention mechanism; And the LM-Trans Block includes layer normalization, window-based attention, residual connection module, layer normalization, LM-MLP based on high-order convergence, and residual module; Preferably, the step of inputting the flow data into the recognition model respectively comprises: Performing preprocessing on the traffic data to obtain a first image and a second image in different representation forms; The first image and the second image are input into the recognition model.

[0010] Preferably, the step of performing preprocessing on the traffic data to obtain the first image and the second image in different forms of expression includes: Identify characteristic information of the traffic data, the characteristic information comprising at least one of a packet size, a timestamp, and five-tuple information, the five-tuple information comprising at least one of a source IP address, a destination IP address, a source port, a destination port, and a transport layer protocol; Splitting the traffic data into sessions according to the characteristic information to obtain a plurality of split sessions; Filter and clean the DNS protocol sessions, TCP handshake failed sessions, and empty sessions in the split sessions to obtain cleaned session data; The cleaned session data is converted into a first image and a second image in different representation forms respectively.

[0011] Preferably, the first image and the second image are expressed in grayscale images and / or flow statistics images; The grayscale image includes an image consisting of a two-dimensional array converted from the byte sequence data of the traffic data; The traffic statistics graph includes an image composed of a three-dimensional array, wherein the three-dimensional array has the arrival time of the data packet in the traffic data as the first dimension, the size of the data packet as the second dimension, and the number of the data packets of the specified size arriving within a specified time period as the third dimension.

[0012] Preferably, the step of inputting the first feature map and the second feature map into a classifier of the recognition model comprises: Fusing the first feature map and the second feature map to obtain a fused feature map; The fused feature map is input into the classifier.

[0013] Preferably, the specific training steps of the model are as follows: Get data samples; Extracting a set of original traffic data packets of the encrypted traffic sample from the data sample; Performing data preprocessing on the original traffic data packet set to obtain a third image and a fourth image; Inputting the preprocessed third image and fourth image into the recognition model to be trained to obtain a third feature map and a fourth feature map, and fusing the third feature map and the fourth feature map to obtain a fused sample feature map; The fused sample feature map is input into the classifier to be trained, and the parameters of the model to be trained are adjusted according to the output of the classifier to be trained until a preset training stop condition is met, thereby obtaining the recognition model.

[0014] Preferably, the step of inputting the first feature map and the second feature map into a classifier of the recognition model comprises: fusing the first feature map and the second feature map to obtain a fused feature map; The fused feature map is input into the classifier.

[0015] An encrypted traffic attack behavior identification training device, comprising: A data acquisition module, used to acquire traffic data; A preprocessing module, used for extracting a set of original flow data packets of the flow data from the flow data; A training module, used for performing data preprocessing on the original traffic data packet set to obtain a first feature map and a second feature map; The identification module is used to input the traffic data into the identification model to obtain the attack type of the traffic data.

[0016] Compared with the prior art, the present invention has the following beneficial effects: a statistical feature map and a grayscale map are formed respectively by preprocessing the encrypted traffic, and two LM-Trans encrypted traffic attack behavior identification models based on high-order convergence are trained respectively to obtain two encrypted traffic feature maps. The model obtains the spatiotemporal characteristics of the traffic through Swim Transformer, accelerates the model convergence speed through the high-order LM-MLP algorithm, obtains multidimensional features through weighted fusion of the two feature maps, and obtains the encrypted traffic attack behavior through the classifier, thereby improving the accuracy of identifying encrypted malicious traffic and improving the overall training speed of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of the encrypted traffic attack behavior training and identification method according to the present invention; Figure 2 This is a flow chart of step S103 of the encrypted traffic attack behavior training and identification method according to the present invention; Figure 3 It is a flow chart of steps S104 and S105 of the encrypted traffic attack behavior training and identification method according to the present invention; Figure 4 This is a flow chart of step S106 of the encrypted traffic attack behavior training and identification method according to the present invention; Figure 5 It is a structural schematic diagram of the encrypted traffic attack behavior identification process of the SDN architecture according to the encrypted traffic attack behavior training and identification method of the present invention; Figure 6 A schematic diagram of a flow chart of a method for training and identifying encrypted traffic attack behaviors according to the present invention; Figure 7 It is a structural schematic diagram of a training device for an encrypted traffic attack behavior identification model according to the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Reference Figure 1 , a method for training and identifying encrypted traffic attack behaviors, comprising the following steps: S101. Obtain flow data samples.

[0020] The traffic data sample can be collected by the terminal device during the traffic data transmission process in the network, or it can be obtained from a preset traffic data database. The present application does not limit the collection method of the traffic data sample, and it can be any existing traffic data sample collection method.

[0021] S102: extracting a set of original traffic data packets of the encrypted traffic data sample from the traffic data sample.

[0022] This step identifies the traffic data sample by an encrypted traffic identification method, divides the sample into a plaintext traffic data set and an encrypted traffic data set, and forms an original traffic data packet set of the encrypted traffic data sample. The encrypted traffic identification method may include content parameter identification, SSL application traffic identification, TLS identification or other methods. The encrypted traffic data label may be obtained by manual marking or by an identification program.

[0023] Or this step forms the original traffic data packet set of the encrypted traffic data sample by acquiring the encrypted traffic data with a label set in the preset traffic database. The encrypted traffic data label is acquired from the encrypted traffic type tag contained in the encrypted traffic data sample.

[0024] The original traffic data packet set of the encrypted traffic data sample includes malicious encrypted traffic and / or non-malicious encrypted traffic. Among them, the malicious encrypted traffic types may include adware, worm virus, Htbot malware, Dridex banking Trojan, TrickBot banking Trojan, Virut file infection Trojan virus, Miuref malicious JavaScript file, WannaCry Eternal Blue ransomware virus, Zeus Trojan malware, Zbot Trojan virus, etc. Non-malicious encrypted traffic may include online chat, email, file, streaming media, Internet phone VoIP, VPN encrypted chat, VPN encrypted email, VPN encrypted streaming media and VPN encrypted Internet phone.

[0025] S103 , performing data preprocessing on the original traffic data packet set, wherein the preprocessing includes converting the original traffic data packet into two different image representation forms.

[0026] The original traffic data packet set is divided into a training set and a test set in a ratio of 7:3, and the training set and the test set are preprocessed respectively. The image is a grayscale image of the original traffic data packet, a statistical feature image of the original traffic data packet, or a unique hot encoding feature image of the data packet. The image can select any two different image representation forms as the input of the encrypted traffic attack behavior recognition model.

[0027] S104. Input the two preprocessed encrypted traffic image data into a double-layer high-order convergence LM-Trans model for training. The double-layer high-order convergence LM-Trans model is specifically composed of two Swim Transformer models optimized by high-order convergence LM multi-layer perceptrons.

[0028] Among them, the two encrypted traffic image data after preprocessing of the training set are input into the double-layer high-order convergence LM-Trans model for training after block division and encoding, and two encrypted traffic feature maps are obtained. The encoding methods include absolute position encoding, relative position encoding and rotational position encoding.

[0029] The LM-Trans model based on high-order convergence includes two consecutive LM-Trans Blocks based on high-order convergence based on window attention mechanism and Patch merging, and the LM-Trans Block based on high-order convergence includes layer normalization, window-based attention, residual connection, layer normalization, LM-MLP based on high-order convergence and residual. The LM-MLP based on high-order convergence adjusts the corresponding parameters of MLP by using the Chebyshev method and the Chebyshev optimization method to obtain the optimized MLP, and the Patch merging is connected to the two consecutive LM-Trans Blocks based on high-order convergence based on window attention mechanism to obtain the LM-Trans model based on high-order convergence.

[0030] S105, fusing two encrypted traffic attack behavior identification feature graphs obtained after training the double-layer high-order convergence LM-Trans model to form a fused feature graph; The two encrypted traffic attack behavior identification feature maps obtained are feature maps of the same size. The feature map fusion method is element-by-element addition, weighted addition and element-by-element multiplication, or splicing the feature maps in the depth dimension to form a multi-dimensional fused feature map.

[0031] S106: Input the fused feature map into the classifier for training to obtain the final recognition model.

[0032] The fused feature graph is input into the classifier for training, and the trained double-layer high-order convergence LM-Trans model and classifier are tested by the test set preprocessed in step S103 to verify the encrypted traffic attack behavior recognition effect of the double-layer high-order convergence LM-Trans model and classifier. When the test result passes, the double-layer high-order convergence LM-Trans model and classifier are used as the trained encrypted traffic attack behavior recognition model.

[0033] The training method of the encrypted traffic attack behavior recognition model provided in the present application converts the traffic data packet into an image form by preprocessing the acquired encrypted traffic data sample, and obtains the encrypted traffic attack behavior recognition model through a double-layer high-order convergence LM-Trans model and classifier training. This method enhances the feature extraction capability of the traffic data packet, improves the accuracy of encrypted malicious traffic identification, and improves the overall training speed of the model by converting the traffic data packet into an image form and a double-layer high-order convergence LM-Trans model.

[0034] Next, taking the conversion of the original traffic data packet into a grayscale image and a statistical feature image as an example, how to perform data preprocessing on the original traffic data packet set in the aforementioned step S103 is described in detail.

[0035] like Figure 2 As shown, the above step S103 specifically includes the following steps: S201. Parse the encrypted traffic data packet set to obtain characteristic information of the encrypted traffic data packet, and split the session according to the characteristic information to obtain multiple sessions.

[0036] The characteristic information of the encrypted traffic data packet includes the data packet size, timestamp and five-tuple information, and the five-tuple information includes the source IP address, the destination IP address, the source port, the destination port and the transport layer protocol.

[0037] The pcap files in the original traffic data packet set are split by data packets. Each type of traffic corresponds to a pcap file. Each data packet is parsed using the Java network protocol parsing library to identify the characteristic information of the original traffic data packet set. Multiple data packets with the same five-tuple information are arranged according to timestamps to form a data stream; data streams with the same source IP and destination IP are then grouped into sessions, thereby achieving session splitting of encrypted traffic data packets and obtaining multiple sessions after splitting.

[0038] S202: Clean the split sessions and remove redundant sessions.

[0039] Among them, the cleaning objects mainly include DNS sessions for host name resolution and sessions with TCP handshake failures. DNS sessions have less effective information for identifying encrypted traffic and are not analyzed. Sessions with TCP handshake failures contain only handshake packets without effective loads, which is not conducive to traffic identification and is also not analyzed. At the same time, it is also necessary to filter empty files generated by empty sessions without loads and files generated by the same session.

[0040] S203: Cut the cleaned session data to obtain session data of two different sizes.

[0041] Among them, the grayscale image is cropped in this way. Since the first 784 bytes of the session data contain the difference characteristics between encrypted malicious traffic and normal encrypted traffic, the length of the cleaned session is uniformly trimmed to 784 bytes, and the insufficient length is padded with zeros at the end.

[0042] The method for cropping the traffic feature statistics graph is to extract four types of statistical feature information of the cleaned session data, namely, the length information, arrival time information, direction information and quantity information of each packet in each session. The four types of statistical feature information are saved in a CSV file, and the session is divided into small blocks of 180 seconds, where the forward flow and the reverse flow have a time of 90 seconds respectively.

[0043] S204 , directly drawing a grayscale image by numerical mapping based on the session data cropped according to the grayscale image cropping method.

[0044] The bytes transmitted by network traffic are between 0 and 255. By converting the byte sequence data into two dimensions, 0 corresponds to black, 255 corresponds to white, and (0, 255) is different degrees of gray, a grayscale image in png format is generated, and the byte information of the data packet is visualized, so that the difference between different traffic flows can be directly felt.

[0045] S205 , the session data cropped according to the cropping method of the statistical feature graph is plotted with a histogram and compressed into a single channel to form a statistical feature graph.

[0046] The four types of statistical feature information are plotted into a three-dimensional histogram, where the x-axis of the histogram represents the arrival time of the data packet, and when x>0, it represents a forward data packet, and when x<0, it represents a reverse data packet. The forward and reverse directions of the data packets are determined by the order in which the IP addresses appear. The y-axis represents the size of the data packet. Since most data packets do not exceed 1500 bytes, the value range of the y-axis is [0,1500]. The z-axis represents the number of data packets of a specific size that arrive within a certain period of time.

[0047] Furthermore, a specific value is used to replace the z-axis histogram, that is, the three-dimensional histogram is compressed and converted into a single-channel image. Indicated in Reached within the time period The size is data packets, and through The direction of the data packet can be determined by the positive or negative value of . Since the input image size of the encrypted traffic attack recognition model is 224×224, it is necessary to further convert the above single-channel image into the corresponding size and normalize the packet size and time to 0 − 224. For the x-axis, the 180s of the session is mapped to 224; for the y-axis, 1500 packets are mapped to 224, and finally a single-channel traffic statistical feature map is formed.

[0048] The method provided in the embodiment of the present application uses a method for preprocessing confidential traffic data packets to split, clean, and trim the original traffic data packets by session, and converts the data packets into grayscale images and statistical feature images based on the traffic data packet feature information and statistical feature information. Compared with other encrypted traffic data packet preprocessing methods, the use of grayscale images and statistical feature images can extract the temporal and spatial features of encrypted traffic data packets in multiple dimensions.

[0049] In addition, in the process of identifying encrypted traffic attack behaviors, the Swin Transformer model has a large amount of computation and slow convergence speed during iterative training, and a large number of parameters are generated. When faced with large-scale and complex encrypted traffic attack behavior identification, it is impossible to give the SDN controller fast identification result feedback, resulting in the SDN controller being unable to detect the occurrence of network attack incidents in a timely and accurate manner based on encrypted traffic attack behaviors, making it difficult to guarantee user network security needs.

[0050] Before the preprocessed two types of encrypted traffic image data are input into the double-layer high-order convergence LM-Trans model and classifier for training to obtain the trained encrypted traffic attack behavior recognition model, a method of a double-layer high-order convergence LM-Trans model can also be included. Figure 3 A flowchart of a method for training an encrypted traffic attack behavior identification model provided in an embodiment of the present application. Figure 3 As shown, the aforementioned steps S104 and S105 specifically include the following steps: S301. Improve the MLP layer in the Swin Transformer model based on the high-order LM algorithm.

[0051] Among them, the LM algorithm is a very effective optimization design method. This algorithm uses approximate second-order derivative information and integrates the advantages of the Gauss-Newton algorithm and the gradient descent method. It has both the local characteristics of the Newton method, that is, it can produce an ideal search direction near the optimal value, and the global characteristics of the gradient method, that is, it descends faster in the initial iteration stage and has certain advantages in convergence.

[0052] In some other examples with high timeliness requirements, the LM algorithm often incurs a large computational cost, its convergence speed is not ideal, and the required storage space is huge. Especially when the number of model parameters is very large, the machine learning algorithm based on LM is almost ineffective.

[0053] In the embodiment of the present application, a high-order convergence LM algorithm is formed by using the Chebyshev method and its optimization method and adjusting the corresponding parameters. In each iteration process, the high-order convergence LM algorithm first solves the linear equations to obtain the first part of the step size : ; In the above formula, the parameters Selected as , The current iteration point Function value at, non-negative parameter It is adjusted autonomously during each iteration. After that, the second step length is obtained as follows: : ; Among them, the intermediate step , is a parameter between 0 and 1. Therefore, in each iteration, the actual step size obtained by the high-order convergent LM algorithm is Under more general assumptions, the point sequence obtained by the high-order convergence LM algorithm is If the convergence conclusion is satisfied, then: ; The above formula proves the superiority of the high-order convergence LM algorithm in terms of convergence and convergence speed, and is highly suitable for optimizing the performance of the MLP network in the Swin Transformer, significantly improving the convergence speed of the Swin Transformer model.

[0054] S302, superimposing two parallel LM-Trans models based on high-order convergence to construct a double-layer high-order convergence LM-Trans model.

[0055] Among them, the double-layer high-order convergence LM-Trans model is composed of two LM-Trans models based on high-order convergence. By training two LM-Trans models based on high-order convergence separately, two feature maps of different dimensions are obtained. Through the weighted fusion algorithm, they are superimposed element by element according to the weight ratio to form a fused feature map. The weighted fusion algorithm can optimize the role of two different feature maps in the recognition process by controlling the weights. The weighted fusion algorithm is: ; in, is a weight factor with a value range of (0,1), which is used to adjust the influence of each feature on the final result. is the fusion feature map, is the grayscale feature, It is the statistical feature map feature.

[0056] The method provided in the embodiment of the present application improves the convergence speed of the LM-Trans model based on high-order convergence through a high-order LM algorithm, and respectively extracts the grayscale graph features and statistical feature graph features of the encrypted traffic data packets by constructing a double-layer high-order convergence LM-Trans model, so that when the double-layer high-order convergence LM-Trans model is used for large-scale complex encrypted traffic attack behavior identification, it can give the SDN controller fast and accurate identification result feedback, so that the SDN controller can promptly detect the occurrence of network attack events according to the encrypted traffic attack behavior, and ensure the user's network security needs.

[0057] After the encrypted traffic is sent to a pre-trained two-layer high-order convergence LM-Trans model for processing, the encrypted traffic attack behavior identification result can be determined.

[0058] like Figure 4 As shown, step S106 specifically includes the following steps: S401. Obtain the fused feature map, and expand it into a one-dimensional vector through a fully connected layer.

[0059] Among them, the expansion method is: input the fused feature map into the pooling layer to improve the feature invariance of the model, perform feature dimensionality reduction, prevent overfitting, and then input the pooled feature map into the fully connected layer to convert the two-dimensional feature map into a one-dimensional vector.

[0060] S402: Input the one-dimensional vector into a classifier to obtain a specific attack type of the encrypted traffic.

[0061] The classification result of the classifier is a binary classification result obtained by using the probability value returned by the Sigmoid function; or a multi-classification result obtained by using the probability value returned by the Softmax function. Taking the Softmax function as an example, the Softmax activation function can obtain the probability of identifying each type of encrypted traffic, and the maximum value is taken as the result of the double-layer high-order convergence LM-Trans model recognition. The Softmax function is: ; in, represents the probability of identifying an input session as the i-th type of traffic, is the score of the corresponding traffic category.

[0062] Next, for the above Figures 1 to 4 The present invention describes a training method for an encrypted traffic attack behavior identification model and a method for using the trained encrypted traffic attack behavior identification model.

[0063] Among them, the encrypted traffic attack behavior identification model is applied to the SDN control plane. Figure 5 The present invention provides a schematic diagram of a structure of an SDN architecture encrypted traffic attack behavior identification process. Figure 5 As shown, the SDN architecture includes: an application plane, an SDN control plane, and a data plane. The application plane is connected to the SDN control plane through the northbound interface of the SDN control plane, and the data plane is connected to the SDN control plane through the southbound interface of the SDN control plane. The SDN control plane includes an SDN controller and the encrypted traffic attack behavior identification model, and the SDN controller is connected to the encrypted traffic attack behavior identification model.

[0064] like Figure 6 As shown, the method of the present application is applied in an SDN controller. This method is used in an SDN controller for the first time and can improve the security detection capability of the SDN controller. Specifically, the following steps are included: S601, obtaining network traffic; Among them, the network traffic data is obtained by the SDN controller from the data plane according to the southbound interface of the SDN control plane, for example, it is obtained from the data forwarding module in the data plane through the southbound interface according to the OpenFlow protocol, and the data forwarding module can be, for example, a switch; the switch can collect large-scale real encrypted traffic data containing multiple traffic types in a complex network.

[0065] S602, inputting the network service data into the encrypted traffic attack behavior identification model to obtain the attack type of the encrypted traffic data; Among them, the encrypted traffic attack behavior identification model is the aforementioned Figures 1 to 5 The trained encrypted traffic attack behavior identification model is obtained by any of the methods provided in . The encrypted traffic data is input into the encrypted traffic attack behavior identification model, and the encrypted traffic attack behavior type is identified by the encrypted traffic attack behavior model, thereby obtaining the specific behavior of the encrypted traffic attack; S603. Manage network security based on encryption attack behaviors.

[0066] The SDN controller analyzes the encrypted traffic based on the encrypted traffic attack behavior identification results, makes reasonable defense decisions, and interacts with the application plane through the northbound interface.

[0067] The method provided in the embodiment of the present application obtains network traffic data and inputs the network traffic data into the aforementioned Figures 1 to 5 In the method embodiment, the specific type of the encrypted traffic attack behavior is obtained from the trained encrypted traffic attack behavior identification model, and network security is managed according to the attack behavior, thereby improving the accuracy and rate of the SDN controller's network security defense.

[0068] like Figure 7 As shown, an encrypted traffic attack behavior identification and training device includes an acquisition module 11, a processing module 12, a training module 13, and an identification module 14.

[0069] The acquisition module 11 is used to acquire traffic data samples, which include malicious encrypted traffic, non-malicious encrypted traffic, malicious plaintext traffic, and non-malicious plaintext traffic types.

[0070] The processing module 12 is used to extract the original traffic data packet set of the encrypted traffic data sample from the traffic data sample, wherein the original traffic data packet set of the encrypted traffic data sample includes malicious encrypted traffic and non-malicious encrypted traffic; and perform data preprocessing on the original traffic data packet set, wherein the preprocessing includes converting the original traffic data packet into two different image representations.

[0071] The training device for the encrypted traffic attack behavior identification model provided in the embodiment of the present application can execute the training method for the encrypted traffic attack behavior identification model in the above-mentioned method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0072] The number of devices and processing scales described here are used to simplify the description of the present invention, and the application, modification and variation of the present invention will be obvious to those skilled in the art.

[0073] Although the embodiments of the present invention have been disclosed as above, they are not limited to the applications listed in the specification and implementation modes. They can be fully applied to various fields suitable for the present invention. For those familiar with the art, additional modifications can be easily implemented. Therefore, without departing from the general concept defined by the claims and the scope of equivalents, the present invention is not limited to the specific details and the illustrations shown and described herein.

Claims

1. A method for training and identifying encrypted traffic attack behavior, characterized in that: The following steps are involved: Get traffic data; Inputting the flow data into the recognition model respectively to obtain a first feature map and a second feature map, and fusing the first feature map and the second feature map; Inputting the first characteristic graph and the second characteristic graph into a recognition model to obtain an attack type of the traffic data; Wherein, the recognition model is a deep learning model obtained based on sample training; The recognition model is composed of a double-layer high-order convergence LM-Trans model, which includes two parallel high-order convergence-based LM-Trans models; the recognition model is trained by a high-order convergence LM algorithm to obtain a fast-converging recognition model.

2. The method for training and identifying encrypted traffic attack behavior according to claim 1, characterized in that: The high-order convergence LM algorithm refers to an algorithm that calculates a step size based on the LM algorithm and performs training according to the step size.

3. The method for training and identifying encrypted traffic attack behavior according to claim 2, characterized in that: The model based on the Swin Transformer architecture includes: two consecutive LM-TransBlock and Patch merging based on the window attention mechanism; The LM-Trans Block includes layer normalization, window-based attention, a residual connection module, layer normalization, a high-order convergence-based LM-MLP, and a residual module.

4. A method for training and identifying encrypted traffic attack behavior as claimed in any one of claims 1 to 3, characterized in that: The step of inputting the flow data into the recognition model comprises: Performing preprocessing on the traffic data to obtain a first image and a second image in different representation forms; The first image and the second image are input into the recognition model.

5. The method for training and identifying encrypted traffic attack behavior according to claim 4, characterized in that: The step of performing preprocessing on the traffic data to obtain the first image and the second image in different forms includes: Identify characteristic information of the traffic data, the characteristic information comprising at least one of a packet size, a timestamp, and five-tuple information, the five-tuple information comprising at least one of a source IP address, a destination IP address, a source port, a destination port, and a transport layer protocol; Splitting the traffic data into sessions according to the characteristic information to obtain a plurality of split sessions; Filter and clean the DNS protocol sessions, TCP handshake failed sessions, and empty sessions in the split sessions to obtain cleaned session data; The cleaned session data is converted into a first image and a second image in different representation forms respectively.

6. The method for training and identifying encrypted traffic attack behavior according to claim 5, characterized in that: The first image and the second image include grayscale images and / or flow statistics images; The grayscale image includes an image consisting of a two-dimensional array converted from the byte sequence data of the traffic data; The traffic statistics graph includes an image composed of a three-dimensional array, wherein the three-dimensional array has the arrival time of the data packet in the traffic data as the first dimension, the size of the data packet as the second dimension, and the number of the data packets of the specified size arriving within a specified time period as the third dimension.

7. The method for training and identifying encrypted traffic attack behavior according to claim 1, characterized in that: The step of inputting the first feature map and the second feature map into the classifier of the recognition model comprises: Fusing the first feature map and the second feature map to obtain a fused feature map; The fused feature map is input into the classifier.

8. The method for training and identifying encrypted traffic attack behavior according to claim 1, characterized in that: The specific training steps of the model are as follows: Get data samples; Extracting a set of original traffic data packets of the encrypted traffic sample from the data sample; Performing data preprocessing on the original traffic data packet set to obtain a third image and a fourth image; Inputting the preprocessed third image and fourth image into the recognition model to be trained to obtain a third feature map and a fourth feature map, and fusing the third feature map and the fourth feature map to obtain a fused sample feature map; The fused sample feature map is input into the classifier to be trained, and the parameters of the model to be trained are adjusted according to the output of the classifier to be trained until a preset training stop condition is met, thereby obtaining the recognition model.

9. An encrypted traffic attack behavior identification device, characterized in that: include: A data acquisition module, used to acquire traffic data; A feature module, used for inputting the flow data into a recognition model respectively, obtaining a first feature map and a second feature map, and fusing the first feature map and the second feature map; A classification module, used for inputting the first feature graph and the second feature graph into a classifier of the recognition model to obtain an attack type of the traffic data; Among them, the recognition model is a deep learning model obtained based on sample training; the recognition model is composed of a double-layer high-order convergence LM-Trans model, and the double-layer high-order convergence LM-Trans model includes two parallel high-order convergence-based LM-Trans models; the recognition model is trained by a high-order convergence LM algorithm to obtain a fast-convergence recognition model.

10. An encrypted traffic attack behavior identification device, characterized in that: It comprises a program storage unit and a program running unit. When the program in the program storage unit is loaded by the program running unit, the encrypted traffic attack behavior training and identification method as claimed in any one of claims 1 to 8 is executed.

Images